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Why GAO Did This Study 

The Freedom of Information Act 
(FOIA) requires federal agencies to 
generally provide the public with 
access to government information. 
In December 2005, the President 
issued Executive Order 13392, to 
improve agencies' FOIA 
processing. The order required 
each agency to review its 
operations and develop plans for 
improvement. 

Since its establishment, the 
Department of Homeland Security 
(DHS) has accounted for a major 
and increasing portion of pending 
FOIA requests governmentwide. 
While it has reported achieving a 
notable reduction since 2006, DHS 
still possesses the largest backlog 
of overdue requests in the 
government. GAO was asked to 
determine (1) what key steps DHS 
has taken to enhance its FOIA 
program, and (2) what 
opportunities exist to improve the 
efficiency and cost-effectiveness of 
FOIA operations across the 
department. To do this, GAO 
reviewed DHS's improvement plan; 
examined policies, procedures, and 
other documentation; and 
interviewed agency officials. 



What GAO Recommends 



GAO is recommending that key 
practices used by certain DHS 
components and other agencies be 
implemented more consistently 
across the department. DHS 
concurred with GAO's assessment 
and recommendations. 



What GAO Found 

DHS has taken steps to enhance its FOIA program. DHS developed an 
improvement plan that focused on eliminating its backlog of overdue requests, 
implementing enhanced training requirements, and deploying more advanced 
technology. Further, the DHS Privacy Office has initiated actions to ensure 
policy compliance and provide oversight of FOIA operations throughout the 
department's component agencies, including developing a departmentwide 
handbook, monitoring monthly data processing statistics, and instituting 
relevant training for employees. As a result, DHS has reported reducing its 
backlog by about 24 percent since implementing its plan. 

However, opportunities exist for DHS to improve the efficiency and cost- 
effectiveness of FOIA processing across the department. Specifically, 
implementation of the following practices could facilitate the processing of 
information requests at a number of its major components: 

• Internal monitoring and oversight. Establishing mechanisms for 
monitoring and oversight of processing efficiency may help reduce the 
backlog of open requests. 

• Component-specific training. Component-specific training could 
enhance the efficiency of processing within component agencies. 

• Online status-checking services. Providing requesters with online 
access to information concerning the status of their requests could 
contribute to better customer service and higher staff productivity. 

• Electronic dissemination of records. Releasing records in an 
electronic format could provide cost savings and increase efficiency. 

• Electronic redaction. By adopting electronic redaction more 
broadly, DHS may be able to reduce the staff time otherwise spent 
manually redacting records, while also improving the consistency of 
its responses to requests. 

By implementing these practices — which are already being used by certain 
DHS components and other agencies — across major DHS components, the 
department could further reduce its backlog, increase efficiency, improve 
customer service, and respond to information requests in a more timely 
fashion. 



To view the full product, including the scope 
and methodology, click on GAO-09-260. 
For more information, contact Gregory C. 
Wilshusen at (202) 51 2-6244 or 

wilshuseng@gao.gov. Unjted states Government Accountability Office 



Contents 



Letter 



Results in Brief 3 

Background 5 

DHS Has Taken Several Key Steps to Enhance Its FOIA Program 10 
Opportunities Exist for DHS to Further Improve FOIA Processing 

within Its Components 14 

Conclusions 25 

Recommendations for Executive Action 26 

Agency Comments 26 



Appendix I 



Objectives, Scope, and Methodology 



28 



Appendix II 



Comments from the Department of Homeland 
Security 



30 



Appendix III 



GAO Contact and Staff Acknowledgments 



33 



Tables 



Table 1: Reported Changes in Overdue Requests at DHS and Its 

Major Components 
Table 2: USCIS Monthly Customer Service Call Volume 



12 
19 



Figure 



Figure 1: Overview of the Generic FOIA Process 



Page i 



GAO-09-260 DHS FOIA Program 



Abbreviations 



CBP 

DHS 

DOJ 

FBI 

FEMA 

FOIA 

ICE 

OIP 

OPEN Government Act 

TSA 
USCIS 

usss 



U.S. Customs and Border Protection 
Department of Homeland Security 
Department of Justice 
Federal Bureau of Investigation 
Federal Emergency Management Agency 
Freedom of Information Act 
Immigration and Customs Enforcement 
Office of Information and Privacy 
Openness Promotes Effectiveness in 
our National Government Act of 2007 
Transportation Security Administration 
United States Citizenship and Immigration 
Services 

United States Secret Service 



This is a work of the U.S. government and is not subject to copyright protection in the 
United States. The published product may be reproduced and distributed in its entirety 
without further permission from GAO. However, because this work may contain 
copyrighted images or other material, permission from the copyright holder may be 
necessary if you wish to reproduce this material separately. 



Page ii 



GAO-09-260 DHS FOIA Program 



gap 

Accountability * Integrity * Reliability 



United States Government Accountability Office 
Washington, DC 20548 



March 20, 2009 

The Honorable Robert C. Byrd 
Chairman 

The Honorable George Voinovich 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
United States Senate 

The Honorable David E. Price 
Chairman 

The Honorable Harold Rogers 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
House of Representatives 

The Freedom of Information Act (FOIA) 1 establishes that federal agencies 
must generally provide the public with access to government information, 
thus enabling them to learn about government operations and decisions. 
Specific requests by the public for information through the act have led to 
the disclosure of waste, fraud, abuse, and wrongdoing in the government, 
as well as the identification of unsafe consumer products, harmful drugs, 
and serious health hazards. 

In December 2005, the President issued Executive Order 13392, aimed at 
improving agencies' disclosure of information consistent with FOIA. 2 The 
focus of the order was to achieve measurable improvements in processing 
(including reducing the backlog of overdue requests) and to reform 
programs that did not produce appropriate results. Among other things, 
this order required each agency to review its FOIA operations and develop 
improvement plans; each agency was to submit a report to the Attorney 
General and the Director of the Office of Management and Budget 
summarizing the results of the agency's review and including a copy of its 
plan. These plans were to include specific outcome-oriented goals and 



! 5 U.S.C. § 552. 

2 Executive Order 13392, Improving Agency Disclosure of Information (Washington, D.C., 
Dec. 14, 2005). 
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timetables, by which the agency head was to evaluate the agency's success 
in implementing the plan. Agencies were also required to include a section 
in their fiscal year 2006 and 2007 annual reports reporting on progress in 
implementing their plans. 

A major focus of the executive order was the reduction or elimination of 
"backlog": requests for records that have not been responded to within the 
statutory time limit — generally 20 working days. 3 (For clarity, we refer to 
this as "backlog of overdue requests" or "overdue requests" to distinguish 
them from "pending requests," which are all open requests, whether or not 
they have been responded to within the statutory time limit.) The 
Department of Homeland Security (DHS) accounts for a major portion of 
pending requests governmentwide and possesses the largest backlog of 
overdue requests in the government. 

In enacting the Consolidated Appropriations Act, 2008, the Committees on 
Appropriations directed us to evaluate the operations of DHS's FOIA 
program. As agreed, our specific objectives were to determine (1) what 
key steps DHS has taken to enhance its FOIA program, and (2) what 
opportunities, if any, exist to improve the efficiency and cost-effectiveness 
of FOIA operations across the department. 

To determine the key steps DHS has taken to enhance its program, we 
reviewed the goals contained in the DHS FOIA improvement plan and 
progress made on these goals, as reported in DHS's annual reports. We 
also assessed actions taken to achieve these goals at seven major DHS 
component agencies — those with the largest number of pending cases at 
the end of fiscal year 2007. These components are U.S. Customs and 
Border Protection (CBP), the Federal Emergency Management Agency 
(FEMA), Immigration and Customs Enforcement (ICE), the 
Transportation Security Administration (TSA), United States Citizenship 
and Immigration Services (USCIS), the United States Secret Service 
(USSS), and the United States Coast Guard. 



3 This time may be extended by no more than 10 days in "unusual circumstances," such as 
when requests involve a voluminous amount of records or require consultation with 
another agency. The time limit refers to the period for the agency to make a determination 
whether to comply with the request. The requester is to be "immediately" notified of the 
determination, the rationale, and of appeal rights for adverse determinations. The recent 
OPEN Government Act of 2007 (Public Law 110-175) has addressed when the 20-day period 
commences and the circumstances under which the period can be suspended (or "tolled"). 



Page 2 



GAO-09-260 DHS FOIA Program 



To determine what opportunities, if any, exist to improve the efficiency 
and cost-effectiveness of operations across the department, we analyzed 
documentation from DHS regarding program structure, procedures, and 
resources. We also reviewed similar documentation from the Department 
of Justice (DOJ) and the Department of State — two agencies with types of 
information similar to DHS — and compared their programs with those of 
DHS. A more detailed description of our objectives, scope, and 
methodology is provided in appendix I. 

We conducted this performance audit from May 2008 to March 2009 in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 



DHS has taken steps to enhance its FOIA program. Specifically, DHS has 
developed an improvement plan that included goals focused on 
eliminating its backlog of overdue requests, implementing enhanced 
training requirements, and deploying advanced technology. Further, the 
DHS Privacy Office has initiated several actions to ensure policy 
compliance and provide oversight of FOIA processing within departmental 
component agencies, such as developing a departmentwide handbook, 
monitoring monthly data processing statistics, and instituting pertinent 
training for employees. As a result, three components have reported 
significantly reducing their backlog of overdue requests. For example, 
USCIS has reduced its backlog from approximately 89,000 in September 
2006 to about 70,000 in October 2008, a 21 percent reduction. Overall, the 
department has reported achieving a backlog reduction of about 24 
percent since implementation of its improvement plan. 

Nevertheless, opportunities exist for DHS to improve the efficiency and 
cost-effectiveness of FOIA operations across the department. Specifically, 
consistent implementation of the following practices across major 
departmental components could facilitate the department's processing of 
information requests: 

• Internal monitoring and oversight. Establishing mechanisms for 

monitoring and oversight of processing efficiency may help components 
reduce their backlogs. Three of the seven major component agencies 
within DHS have reported implementing monitoring and oversight 
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mechanisms within their programs and have reduced their backlogs. The 
remaining four have not implemented such mechanisms, nor have they 
made comparable reductions in their backlogs. By more consistently 
establishing monitoring and oversight processes, DHS could reduce the 
risk of not being able to provide responses to requests within the statutory 
time limits. 

• Component- specific training. Component-specific training — which goes 
beyond general training to address processing details that are unique 
within each of the components — could enhance the consistency and 
efficiency of processing within those components. Of the seven major 
components, five have begun implementing in-house component-specific 
training for their staff. Officials from one of these components stated that 
staff appeared more prepared to respond to requests, particularly 
regarding the application of exemptions. While the other DHS components 
provide some form of training to their staff, it is not tailored to their 
unique needs and circumstances. By developing and implementing 
specialized training programs for their staff, components may be able to 
increase the consistency and efficiency of their processing. 

• Online status-checking services. Providing requesters with online access 
to information concerning the status of their requests can contribute to 
improved customer service and staff productivity. Two of the seven major 
components have deployed or are in the process of deploying an online 
status-check service, while five do not provide the service. Officials from 
the component that has deployed the service reported a reduction in the 
number of customer service calls, which has allowed staff to spend more 
time on other duties. By implementing this service more broadly, the 
department might be able to realize cost savings and customer service 
benefits. 

• Dissemination of records in an electronic format. The format (paper or 
CD) in which a FOIA office releases records to requesters can affect 
operating expenditures and processing efficiency. Three of the seven 
major components have adopted electronic dissemination for larger 
requests and reported reducing operating costs as a result. By 
disseminating more records in an electronic form, DHS may be able to 
reduce the operational costs of processing requests. 

• Electronic redaction. Currently, five of DHS's seven major components 
have broadly adopted electronic redaction processes and have reported 
gains in staff efficiency as a result. The other two major components 
continue to manually redact most records. By adopting electronic 
redaction more broadly, these components may be able to reduce the time 
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otherwise spent manually redacting records, while also improving the 
consistency of their products. 

To help improve the efficiency and cost-effectiveness of the department's 
FOIA program, we are recommending that the Secretary of Homeland 
Security take actions to ensure that these key practices are consistently 
adopted across the department's major components. In written comments 
on a draft of this report, DHS concurred with our assessment and 
recommendations and described actions underway to address the 
recommendations. 



Background FOIA establishes a legal right of access to government records and 

" information on the basis of the principles of openness and accountability 

in government. Before the act (originally enacted in 1966), 4 the 
government required individuals to demonstrate "a need to know" before 
granting the right to examine federal records. FOIA established a "right to 
know" standard, under which an organization or any member of the public 
could receive access to information held by federal agencies without 
demonstrating a need or reason. The "right to know" standard shifted the 
burden of proof from the individual to government agencies and required 
agencies to provide proper justification when denying requests for access 
to records. 



FOIA provides the public with access to government information either 
through "affirmative agency disclosure" — publishing information in the 
Federal Register or on the Internet or making it available in reading 
rooms — or in response to public requests for disclosure. Public requests 
for records are the best known type of disclosure, and require agencies to 
promptly provide records in any readily producible form or format 
specified by the requester. 

Not all information held by the government is subject to FOIA. The act 
prescribes nine specific categories of information that can be exempt from 
disclosure, including, but not limited to, trade secrets and certain 
confidential commercial or financial information, certain personnel and 
medical files, and certain law enforcement records. 5 When agencies deny 



4 The act has been amended several times. 

5 There are also FOIA exclusions for specific, sensitive records held by law enforcement 
agencies. 
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all or part of a request, the act requires that agencies notify requesters of 
the reasons for the adverse determination and grants requesters the right 
to appeal the decision. 

The Department of Justice (DOJ) is the primary source of FOIA oversight 
and policy guidance for agencies. Within the department, the Office of 
Information and Privacy (OIP) has lead responsibility for providing 
guidance and support to federal agencies on FOIA issues. OIP issues a 
guide addressing various aspects of the act and conducts a variety of 
related training programs for personnel across the government. 



On December 14, 2005, the President issued Executive Order 13392, 
setting forth a policy of citizen-centered and results-oriented FOIA 
administration. The order directed agencies to provide requesters with 
courteous and appropriate service, as well as ways to learn about the 
FOIA process, the status of their requests, and the public availability of 
other agency records. The order also instructed agencies to process 
requests efficiently, achieve measurable process improvements (including 
a reduction in the backlog of overdue requests), 6 and reform programs that 
did not produce appropriate results. A major focus of the order was for 
agency plans to include specific actions to eliminate or reduce any backlog 
of overdue requests. 

To carry out this policy, the order required, among other things, that 
agency heads designate Chief FOIA Officers to oversee their programs. 
The officers were directed to review their operations and develop 
improvement plans to ensure that administration of the act was in 
accordance with applicable law, as well as with the policy set forth in the 
order. By June 2006, agencies were to submit reports that included the 
results of their reviews and copies of their improvement plans. 

In April 2006, OIP posted guidance to assist federal agencies in 
implementing the order's requirements for reviews and improvement 



Executive Order Led to 
Activities Aimed at 
Improving FOIA 
Operations 



6 "Backlog requests" refer to FOIA requests to which an agency fails to respond within the 
statutory time limit. Backlog requests are distinct from the "pending cases" that are 
reported in the annual reports. The latter are FOIA cases that remain open at the end of the 
reporting period. In reports GAO issued before the President issued Executive Order 13392, 
GAO used the term "backlog" to refer to these pending cases. 
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plans. 7 The guidance suggested several potential areas that agencies might 
consider when conducting their reviews, such as enhanced training, 
centralization of administration, automation of request tracking, 
automation of electronic records dissemination, and improved records 
redaction. 



In order to extend the backlog reduction efforts beyond the time frame of 
the executive order, in September 2007, OIP posted guidance to agencies 
on submitting backlog reduction goals for fiscal years 2008, 2009, and 
2010. 8 Any agency that had a request or appeal pending beyond the 
statutory time limit at the end of fiscal year 2007 was to establish backlog 
reduction goals for fiscal years 2008, 2009, and 2010. In addition, in June 
2008, OIP posted guidance requiring all agencies that had not made 
progress in reducing their backlogs over the previous 2 years to prepare 
backlog reduction plans. 

On December 31, 2007, the Openness Promotes Effectiveness in our 
National Government Act of 2007 (OPEN Government Act) was enacted. 
This law amended FOIA by, among other things, addressing the time limits 
for agencies to act on requests, requiring agencies to designate chief FOIA 
officers, requiring that agencies assign a tracking number to each request 
requiring more than 10 days to process, and requiring agencies to establish 
a telephone line or Internet service that requesters could use to determine 
the status of their request. 



An Overview of the FOIA Although the specific procedures for handling requests vary among 
Process at Federal agencies, the major phases in the process are similar across the 

Agencies government: receiving the request, logging and scoping the request, 

& searching for and retrieving potentially responsive records, preparing 

records for release, performing a final review, and releasing records to the 
requester. Figure 1 depicts the process, from the receipt of a request 
through the release of records. 



department of Justice, Executive Order 13392 Implementation Guidance (posted Apr. 27, 
2006). See http://www.usdoj.gov/oip/foiapost/2006foiapost6.htm. 

8 The template for the backlog reduction goals was amended in October 2007. Department 
of Justice, Modified Templates to Use When Submitting Backlog Reduction Goals for 
Fiscal Years 2008, 2009, and 2010. See 
http://www.usdoj.gov/oip/foiapost/2007foiapostl8.htm. 
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Figure 1 : Overview of the Generic FOIA Process 
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Source: GAO analysis of agency information. 



The process begins when an agency receives (whether by mail, phone, fax, 
or over the Internet) a request for federal records. A staff member logs the 
request in the agency's tracking system, and then reviews the request to 
determine its scope, estimates fees, and provides an initial response to the 
requester. Next, the staff searches for responsive records, which may 
include searching for records at multiple locations and program offices. 
After they are located, the records are reviewed to confirm that they are 
within the scope of the request. 

The staff then prepares records by removing any nonreleasable 
information based upon the statutory exemptions — a process known as 
redaction. Once records have been prepared, the staff calculates any 
applicable fees for research time and reproduction costs. 9 After redaction 
and fee calculation, the staff submits the records for a final review, 
possibly by the agency's general counsel. If records pass this final review, 
the agency generates a response letter summarizing actions regarding the 
request and releases the records to the requester. 

Some requests are relatively simple to process, such as requests for 
specific pieces of information that the requester sends directly to the 



Fees may be waived when disclosure of the information requested is determined to be in 
the public interest because it is likely to contribute significantly to public understanding of 
the operations or activities of the government and is not primarily in the commercial 
interest of the requester. 
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appropriate office. Other requests may require more extensive processing, 
depending on their complexity, the volume of information involved, 
whether the agency FOIA office is required to work with offices with 
relevant subject-matter expertise to find and obtain information, the 
requirement for a FOIA officer to review and redact information in the 
responsive material, the requirement to communicate with the requester 
about the scope of the request, and the requirement to communicate with 
the requester about the fees that will be charged for fulfilling the request 
(or whether fees will be waived). 

The organizational structure of an agency's program can affect its 
processing procedures. While some agencies centralize processing in one 
main office, others receive and process requests at the division or field 
office level. The structure influences how and where requests are received 
by the agency, how an agency searches for responsive records, the 
availability of relevant subject matter experts, and how an agency 
monitors the status of requests. 



The DHS FOIA Program Is Established in 2003, DHS is responsible for leading the effort to secure the 
Largely Decentralized United States by preventing and deterring terrorist attacks and protecting 

against, and responding to, threats and hazards to the nation. To 
accomplish its mission, DHS incorporated 22 separate federal agencies 
and organizations, including FEMA (formerly an independent agency) and 
the Immigration and Naturalization Service (formerly part of DOJ). Several 
of these agencies remained separate component agencies within DHS, 
while others were reorganized into new DHS components. The functions 
of the Immigration and Naturalization Service, for example, were divided 
among three DHS components: CBP, ICE, and USCIS. 

FOIA processing is implemented separately within each of the major DHS 
component agencies. At the department level, the Privacy Office 
coordinates agencywide implementation by developing policy, performing 
oversight of component operations, providing training, and preparing the 
annual FOIA report. The Privacy Office also processes requests related to 
DHS headquarters operations. However, all other processing of requests is 
handled by agency components, which staff and operate their own offices. 
FOIA officers within these components are responsible for managing and 
implementing their respective operations, as well as defining their 
administrative structures. 

The scale and performance of FOIA processing vary across the 
department. The components with the largest reported number of pending 
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cases at the end of fiscal year 2007 included CBP, FEMA, ICE, TSA, USCIS, 
USSS, and the United States Coast Guard. These components are also 
among those to have received and processed the largest number of 
requests in fiscal year 2007. 



DHS Has Taken 
Several Key Steps to 
Enhance Its FOIA 
Program 



In response to Executive Order 13392, DHS and its major components 
have taken steps to enhance the department's program. DHS developed an 
improvement plan that included goals focused on eliminating its backlog 
of overdue requests, implementing enhanced training requirements, and 
deploying advanced technology. In addition, the DHS Privacy Office 
initiated several actions to ensure policy compliance and provide oversight 
of individual components, such as developing a departmentwide 
handbook, completing file reviews at each component, monitoring 
monthly data processing statistics, and instituting training for affected 
employees. As a result, several of the components have reported 
decreasing their backlogs of overdue requests. Specifically, three 
components reported achieving large reductions in their backlogs. 



The DHS Improvement 
Plan Outlined Goals for 
Eliminating Backlog and 
Improving Training and 
Technology 



In January 2007, DHS submitted an improvement plan that focused on 
eliminating the backlog of overdue requests, enhancing education and 
training, and implementing technological advancements. In order to 
formulate its plan and specific goals, DHS surveyed each component and 
office on specific issues relating to FOIA operations, such as staffing 
levels, electronic processing capabilities, training opportunities and 
requirements, and impediments other than staffing that contribute to 
backlogs. 



To reduce its backlog, DHS established goals that included hiring 
additional personnel, implementing operational improvements at USCIS, 
meeting with an important requester group (the American Immigration 
Lawyers Association) to discuss file processing and customer service 
enhancements, and establishing a monitoring program under which all 
components submitted weekly and monthly data to the Chief FOIA 
Officer. 



Goals related to education and training included establishing a renewed 
emphasis on the importance of FOIA and instituting semiannual FOIA 
officer meetings; they also required components and offices to provide all 
employees with information about their obligations and all professional 
staff who spend more than half of their time implementing the act to take 
annual training offered by DOJ's OIP. 
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Lastly, goals for technological improvements included identifying a Web- 
based case management software application with electronic tracking 
capabilities, setting a recommended departmentwide standard for 
processing software, requiring all component offices to have a Web site or 
a link to the departmental FOIA Web site from their component home 
page, and increasing proactive disclosure of documents on component and 
office Web sites to allow public access to records without submitting a 
formal request. 



The DHS Privacy Office 
Has Taken Steps to 
Improve Departmental 
Oversight of Its FOIA 
Operations 



In response to the executive order and to elevate the importance of the act 
at the department level, the Chief FOIA Officer established a new position 
of Deputy Chief FOIA Officer within the DHS Privacy Office. 10 This 
position was established to, among other things, assure program oversight 
over all of the components. 

The Privacy Office initiated several actions to ensure policy compliance 
and provide oversight to individual components. For example, the office 
developed a handbook for use departmentwide. The document, which is 
undergoing internal review, establishes policies and procedures that each 
component must follow. In addition, the Deputy Chief FOIA Officer and 
the Associate Director of Disclosure Policy and FOIA Program 
Development visited each component for an informal file review. They 
reviewed select cases at each component in order to ensure compliance 
with department policies and identify any processing problems. If a 
problem was detected, they revisited those components to help develop a 
plan of action to remedy the problem. 

In an effort to reduce backlog, the DHS improvement plan required all 
components to submit monthly data reports. These reports included the 
number of open cases, time ranges of the open cases, the date of the oldest 
request, the number of staff, and the number of requests received and 
processed that month. After receiving the reports, the Deputy Chief FOIA 
Officer was to notify each component via e-mail regarding their progress 
against backlog goals set in response to DOJ guidance. 

Lastly, to ensure compliance with department policies, the Privacy Office 
has set requirements for training. The DHS improvement plan stated that 



10 The Chief Privacy Officer for DHS serves as the Chief FOIA Officer for the department 
and has agencywide policy responsibility for efficient and appropriate FOIA compliance. 
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education and training would ensure a consistent interpretation of 
common aspects of the administrative process. Accordingly, it required 
that all components make available "FOIA 101" training for employees 
with FOIA-related duties. The training includes an overview of the history 
of the act, DHS's FOIA organization chart, information on the life cycle of 
a request, staff responsibilities, and information on exemptions. In 
addition, all staff that spent more than 50 percent of their work time on 
FOIA were required to take annual training offered by DOJ's OIP or an 
equivalent. 



Several DHS Components 
Have Reported Reductions 
in Their Backlogs of 
Overdue Requests as a 
Result of Departmental 
Improvement Efforts 



Following the emphasis on backlog reduction in Executive Order 13392 
and DHS's improvement plan, three of the seven major components have 
reported progress in decreasing their backlogs of overdue requests. As of 
October 17, 2008, the overall departmental backlog has been reduced 
about 24 percent since September 2006. Factors contributing to this 
reduction include enhanced oversight by the Privacy Office and program 
modifications instituted by individual components, such as centralizing 
operations, hiring additional personnel, and technology improvements. 
Table 1 shows the reported overall DHS reduction in overdue requests and 
the changes in overdue requests experienced by each of its major 
components. 



Table 1 : Reported Changes in Overdue Requests at DHS and Its Major Components 





Number of overdue requests as of 


Fall/rise 


DHS 

component 


September 15, 2006 


October 17, 2008 


Number 


Percentage 


DHS total 


99,211 


75,163 


-24,048 


-24.2% 


ICE 


7,346 


16 


-7,330 


-99.8 


USCIS 


89,124 


70,175 


-18,949 


-21.3 


USSS 


730 


560 


-170 


-23.3 


Coast Guard" 


906 


1,152 


+246 


+27.2 


FEMA 


236 


619 


+383 


+162.3 


CBP 


524 


2,198 


+1,674 


+319.5 


TSA 


45 


321 


+276 


+613.3 


All other 
components 


300 


122 


-178 


-59.3 



Source: GAO analysis of self-reported agency data. 



"Coast Guard was unable to report its number of overdue requests for September 2006; monthly 
numbers used are from August 2006 and represent headquarters' overdue cases only. 
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USCIS has reported a substantial reduction in its backlog. Despite having 
one of the highest backlogs within the department and the federal 
government, it has reduced its backlog by 18,949 requests (about 21 
percent) since September 2006. Component officials attributed the 
reduction to the centralization of their FOIA program, hiring of additional 
staff, and the elimination of 23,179 requests whose requesters did not have 
continued interest in obtaining the information. In October 2007, USCIS 
completed a transition from 50 decentralized FOIA offices to a single 
centralized office. The centralization enabled them to maximize their 
resources and focus on reducing their backlog of overdue requests. The 
component has also hired 10 additional staff since the centralization. In 
addition, in July 2008, USCIS awarded a backlog reduction contract 
intended to eliminate its backlog within 15 to 18 months from the award of 
the contract. The contract is to provide 74 staff that will be tasked to 
process the oldest requests until the entire backlog is exhausted. 

Likewise, ICE has also reported a considerable reduction in its backlog of 
overdue requests. According to agency officials, an almost 100 percent 
reduction has been achieved since September 2006, reducing the number 
of overdue requests by about 7,300. The component took a variety of 
actions, including centralizing its program and implementing a new 
electronic tracking system. The FOIA Officer stated that centralization of 
the program allowed for greater consistency in processing procedures and 
the use of technology. In addition, ICE was able to eliminate 
approximately 1,200 overdue requests by determining that the requesters 
were no longer interested in them. 

As part of its operational improvements in FOIA processing, DHS officials 
reported that they had improved the way the department handles requests 
relating to Alien-File (A-File) records, 11 which are processed by USCIS and 
ICE. Both components experienced a large reduction of their backlogs by 
streamlining the approach used for processing these requests. Previously, 
a major hurdle these components faced was the sharing of the existing 55 
million hardcopy A-Files. Because the A-Files contain both benefit and 
enforcement documents, an individual file may be in the possession of 
either component at any given time. When either one of the components 
received a request for the contents of a file, that component had to locate 



For more information on A-Files, see GAO, Immigration Benefits: Additional Efforts 
Needed to Help Ensure Alien Files Are Located when Needed, GAO-07-85 (Washington, 
D.C.: Oct. 27, 2006). 
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the file and determine whether it should have responsibility for processing 
the request. After November 2006, the ownership of all A-Files was 
transferred to USCIS. In order to facilitate faster processing, ICE provided 
USCIS with a processing guide containing the policies, procedures, and 
background information necessary to enable USCIS to process A-File 
requests on behalf of ICE. This process eliminated the need to refer 
records to ICE for review and determination of releasability, which could 
result in unnecessary delays. 

USSS reported a 23 percent reduction in its backlog of overdue requests 
since September 2006, reducing the number of overdue requests by 170. 
Officials stated that this reduction was mainly due to the addition of staff 
supporting the FOIA mission and the creation of a task force, consisting of 
employees from each directorate, to focus on closing overdue requests 
over a 3-month span. 



Opportunities Exist 
for DHS to Further 
Improve FOIA 
Processing within Its 
Components 



DHS components and other federal agencies have identified key practices 
they have adopted to improve the efficiency and cost-effectiveness of their 
request-processing operations. These key practices include internal 
monitoring and oversight to help reduce component backlogs, specialized 
training within components, providing requesters with online access to 
information concerning the status of their requests, releasing records in an 
electronic format, and the use of electronic redaction. 



Internal Monitoring and 
Oversight Could Help 
Reduce DHS Components' 
Backlogs 



Based on actions taken at DOJ, as well as within several DHS components, 
implementing an internal monitoring and oversight process can help 
agencies better track their processing efficiency and thus reduce their 
backlogs of requests. These organizations have found that the ability to 
monitor the status of incoming requests can greatly enhance their ability 
to meet the statutory time limit to respond to them because it can help 
reduce the amount of time needed to determine the location of responsive 
records and retrieve them for processing. Close monitoring helps ensure 
that requests and their associated records do not languish unattended at 
any given step in the process. 



DOJ's Executive Office for Immigration Review has reported that it 
implemented an oversight and monitoring process for its FOIA program. It 
operates a centralized program, where all requests are received at the 
main office. Responsive records may be located at any one of the 54 
immigration courts throughout the United States. According to DOJ 
officials, in order to facilitate a timely and efficient response from the 
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immigration courts, at the end of each day, the main office automatically 
generates and sends a report to any immigration court that has been 
identified as possessing responsive records for an outstanding request. 
The officials stated that by closely monitoring those courts that were slow 
in sending responsive records, it has been able to obtain records in a more 
timely manner. 

Likewise, within DHS, three of the seven major DHS components have 
reported implementing mechanisms for monitoring the processing of 
information requests. For example, USCIS operates a centralized FOIA 
program from the National Records Center in Lee's Summit, Missouri. All 
requests are received at the center and imported into an electronic 
tracking system. The system allows staff to track the status and 
whereabouts of each request from receipt until it has been closed. In 
addition, the component uses bar codes to associate records with a 
physical location. As a result, files can be rapidly located at the center or 
at any other location. The chief program official stated that the use of the 
bar codes greatly sped up the process of locating responsive records for 
processing. In these cases, staff can identify the location of records using 
the bar code and contact the appropriate office to obtain copies for 
processing. In addition, USCIS has staff dedicated to the continual 
monitoring of outstanding records. Each month, USCIS sends reports to 
its field sites and other components that have outstanding records in order 
to expedite the process. According to program officials, these monitoring 
and oversight mechanisms have contributed to the reduction of the 
backlog of overdue requests. 

ICE officials also reported that they have implemented monitoring and 
oversight mechanisms. The component operates a centralized program, 
where all of the requests are received at the main office. After a request is 
received, staff input it into a tracking system, and then it is assigned to the 
appropriate office for processing. The tracking system allows staff to 
obtain key information about the request, such as the responsible office, 
the date by which the records need to be received at the main office, and if 
applicable, the number of days by which the request is overdue. In 
addition, the program director generates a weekly report that identifies 
any requests that have not been responded to within the allotted time and 
sends messages to notify program offices of their overdue responses. In 
order to facilitate timely and efficient retrieval of records, program offices 
have the ability to provide their responses via e-mail to the main office. 
The program director stated that this monitoring process and the ability of 
program offices to send responsive records by e-mail have greatly 
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improved the timeliness of responses to information requests and reduced 
the backlog of overdue requests. 

In technical comments on a draft of this report, USSS stated that it has a 
system for tracking due dates for incoming requests and also has the 
ability to generate reports to monitor overdue requests to ensure timely 
responses. 

In contrast to these examples, the other major components have not yet 
implemented comparable monitoring and oversight mechanisms. For 
example, although CBP, FEMA, and TSA operate centralized FOIA 
programs where all requests are received or tracked at one location, none 
currently has a mechanism for obtaining responsive records from field 
offices expeditiously. 

Lastly, because the Coast Guard operates its program in a decentralized 
fashion — each of its 1,300 units is able to directly receive and respond to 
requests — it has limited ability to monitor the status of individual requests 
or whether responsive records have been located and retrieved. The Chief 
of the Office of Information Management estimated that between two- 
thirds and three-fourths of all requests are received and answered in field 
offices. The Coast Guard currently does not have an oversight mechanism 
to monitor the timeliness of processing at its individual units. 

Given the success of using monitoring and oversight processes at DOJ and 
two DHS components, the department may be able to improve 
responsiveness to requests and reduce backlogs at other major 
components by establishing mechanisms to efficiently monitor and 
oversee internal processing of information requests within those 
components. 



Component-Specific 
Training Could Help 
Enhance the Efficiency of 
FOIA Processing 



Based on actions taken at DOJ, as well as within several DHS components, 
component-specific training — which goes beyond general training to 
address processing details that are unique within each of the 
components — can help ensure consistent administration of the FOIA 
process within each component. The department improvement plan 
acknowledges that specialized training is essential for processing 
professionals. Further, DOJ's OIP highlighted the need for enhanced 
training in its guidance on activities required by Executive Order 13392. 
The guidance states that the issuance of Executive Order 13392 is a good 
occasion for agencies to, among other things, consider whether they are 
conducting their own training sessions with sufficient regularity. 
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While certain basic aspects of FOIA implementation are the same 
throughout a large department such as DHS, other aspects of the process 
can vary in significant ways across the department's components. For 
example, each component possesses different types of records; some 
agencies may have primarily first-party records (such as USCIS's A-Files), 
while others may have more records relating to investigations (such as the 
Coast Guard's Marine Investigations). Further, component agencies are 
likely to utilize specific exemptions that directly relate to the records they 
possess. For example, some may frequently use an exemption that focuses 
on an agency's internal personnel rules and practices, while others may 
more often use an exemption for information compiled for law 
enforcement purposes. 

Two component agencies within DOJ reported utilizing component- 
specific training for their staff to enhance the efficiency of their processing 
information requests. Specifically, according to agency officials, the 
Federal Bureau of Investigation (FBI) provides its new staff with entry- 
level, basic, and advanced training programs. The entry-level staff undergo 
a 6-week training regimen that includes an overview of the type of records 
at the FBI, how to scope requests and search for records, and how to use 
the bureau's tracking system. After the staff complete the entry-level 
training, they are required to take one of two additional training classes, 
depending on their job responsibilities. Advanced training is also available 
on litigation support and prepublication review. FBI officials stated that, in 
their opinion, the training program was responsible for the retention of 
qualified staff because the progression and challenges presented by the 
various levels of training allowed staff to develop their FOIA expertise. 

Likewise, DOJ's Executive Office for United States Attorneys offers a 
specialized training conference for FOIA staff at each of the U.S. Attorney 
offices. The training conference includes explanations of FOIA 
exemptions and how they are used, a discussion of the intake process, 
examples of forms used in the process, and a discussion of the FOIA 
contacts' role. In addition, officials stated that the Executive Office 
records its training conference and makes it available online for staff to 
view. Each new field office employee is required to take the training. 

Five components within DHS have similarly implemented in-house, 
component-specific FOIA training for their staff: 

• USCIS provides newly hired staff with a mandatory training program that 
includes guidance tailored to its program. In a report written in response 
to the Executive Order, the USCIS's Ombudsman recognized that frequent 
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and useful training for new and existing staff had been lacking and 
recommended that a training program be developed and implemented for 
all staff to ensure effective compliance. In response to the 
recommendation, USCIS developed a mandatory in-house training 
program that includes hands-on modules for processing and approving 
information requests. The new program included a focus on rules 
regarding exemptions as applied to USCIS, analysis of typical case studies, 
and procedures for handling documents from other components, such as 
ICE. The Chief of the USCIS FOIA Program stated that staff who had 
participated in the new training program appeared more prepared to 
respond to requests, particularly regarding the application of exemptions. 

• The Coast Guard provides an annual specialized training seminar to all 
FOIA Coordinators and personnel who process requests. The training 
includes a description of records, good record management practices, 
overview of exemptions, multiunit responses, and search standards. 

• ICE hosts a specialized "virtual-university" training module, which 
includes information on how to process a request, what files are covered 
by FOIA, and what may be withheld from disclosure under an exemption. 

• TSA offers a specialized online training module, which describes typical 
types of requested records and how to process a request. 

• CBP provides an 8-hour training class several times a year where staff are 
introduced to the procedures involved in responding to a request in a 
timely manner, how to create a case file, how to conduct an adequate 
search for records that are responsive to the request, and how to employ 
the nine exemptions for CBP records. Additionally, they also provide 
tailored training sessions to offices that handle certain specialized records. 

In contrast, two major DHS components do not make specialized, 
component-specific training available to their staff. USSS and FEMA 
provide only on-the-job training or "generic" training offered by outside 
contractors. For example, USSS provides on-the-job training and 
shadowing and mentoring programs for its staff, who are required to 
attend outside training, such as the DOJ OIP training, American Society of 
Access Professionals conferences, and classes at the United States 
Department of Agriculture Graduate School. 

While generic training offered by outside professionals is valuable, 
component-specific training can better ensure compliance with 
component-specific policies and procedures and greater consistency in the 
application of exemptions. Also, offering this specialized training to new 
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staff ensures that they are knowledgeable about policies and component- 
specific practices before they begin processing requests, which can yield 
faster processing times and more accurate and consistent processing. 
USSS and FEMA may have opportunities to enhance the consistency and 
accuracy of their processing by developing and implementing specialized 
training programs for their staff. 



Based on experience at a major DHS component, providing requesters 
with online access to information concerning the status of their requests 
can contribute to improved customer service and staff productivity. 
According to officials at USCIS, not only does an online status-check 
service provide requesters with instant access to information, it also 
reduces the need to divert staff resources away from request processing to 
respond to telephone status inquiries. 

Actions at USCIS have shown that productivity and efficiency can be 
enhanced by implementing an online status-check service. According to 
component officials, since it was initiated in May 2008, the USCIS service 
has contributed to improved staff productivity and provided requesters 
with faster access to status information. The system allows requesters to 
access status information by entering their unique tracking number into a 
form on USCIS's FOIA Web site. The Web site then returns real-time status 
information extracted from the component's tracking system. 

Agency officials reported that the service has improved the efficiency of 
their program. Since deploying the service in May 2008, USCIS reported 
experiencing a reduction of customer service phone calls received in the 
following 3 months. As reflected in table 3 below, the monthly call volume 
for the months following implementation (May through October) was less 
than during the 4 months prior to implementation (January through April). 
USCIS officials estimated that 60 percent of all FOIA-related customer 
service phone calls are status inquiries. 



Table 2: USCIS Monthly Customer Service Call Volume 


Month (2008) January February March 


April 


May 


June 


July 


August 


September 


October 


Number of customer 

service calls received 2,857 2,636 2,619 


2,803 


2,677 


2,554 


2,449 


2,301 


2,318 


2,473 



Source: Self-reported agency data. 



The Director of the National Records Center stated that the online status- 
check service, by reducing the number of customer service calls, has also 



Providing Request Status 
Information Online Could 
Enhance Staff Productivity 
and Customer Service at 
DHS Components 
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allowed staff to spend more time on other duties, such as processing 
requests. Before USCIS deployed the service, requesters seeking 
information about their requests needed to call the service center and 
speak directly with staff. 

Like USCIS, ICE has also developed and implemented an online status- 
check service. Deployed in December 2008, it allows requesters to query 
the tracking system regarding the status of their requests by filling out a 
form on the agency's Web site. ICE's FOIA Officer described the online 
status-check service as part of an effort to enhance customer service and 
reduce the number of status request phone calls ICE receives. At the time 
of our review, the ICE service had not been in operation long enough for 
data to be collected on the benefits it has yielded. 

In contrast to USCIS and ICE, the other five major DHS components have 
not yet deployed online status-check services. In order for agency 
components to provide an online status-check capability, they must 
maintain tracking systems that capture status information for all requests 
and can make it available for online queries. Three of the five components 
operate comprehensive tracking systems but do not provide the service. 
The other two neither provide an online service nor possess a sufficiently 
comprehensive tracking system to support one. 

USSS is an example of a component that has not deployed an online 
status-check service, even though it operates a comprehensive tracking 
system. The agency instructs requesters who are seeking status 
information to call the FOIA service center or submit their request's 
unique tracking number through its Web site. Once a status inquiry is 
received, staff search the tracking system to provide requesters with status 
information. Agency officials stated that, in response to Executive Order 
13392, USSS is considering the feasibility of deploying an online status 
system. By deploying such a service, the component may be able to reduce 
the staff resources it currently devotes to responding to status inquiries. 

Like USSS, FEMA does not provide an online service, despite operating a 
comprehensive tracking system. Currently, when requesters call or e-mail 
FEMA's central office seeking status information, staff must contact the 
relevant program offices to determine the status of the request and relay 
that information to the requester. Agency officials stated that responding 
to requester calls to its FOIA Helpline was a full-time job, and that 
transitioning to an online status service would be cost-effective and 
efficient for both the agency and requesters. Although agency officials 
stated that FEMA is developing a database feature to allow requesters to 
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view status information through its FOIA Web site, they did not provide an 
estimate of when the service would be available. Until the online status 
service is made available, FEMA will likely continue to devote significant 
staff resources to responding to status inquiries. 

TSA also continues to use staff to manually search its tracking system to 
determine a request's status. TSA officials stated that, for technical 
reasons, it would not be feasible to develop an online status service based 
on its current comprehensive tracking system. Instead, staff reply to 
requester inquiries in the same format (e-mail or phone) that the inquiry 
was received, typically within 24 to 48 hours. Agency officials also stated 
that the FOIA office is exploring adopting other case management 
software applications that could support an online status service. If TSA 
ultimately develops such a capability, it might be able to reduce the staff 
resources devoted to responding to status inquiries. 

Currently, the FOIA tracking systems at the Coast Guard and CBP are not 
sufficiently comprehensive to support an online status service. The Coast 
Guard operates separate tracking systems for each of its 1,300 field 
offices. Requesters seeking the status of their requests must inquire 
directly with the Coast Guard field office responsible for processing the 
request. Similarly, CBP cannot yet provide a component-wide online status 
service because its tracking system does not capture current status 
information for commercial or financial requests processed by offices or 
ports other than its central office. For such requests, CBP's tracking 
system, which is manually updated each month, records when the request 
was received and to which office or port it was referred. The tracking 
system is also updated when the office or port notifies the central office 
that the request was processed. CBP officials stated that they had not 
deployed an online service for noncommercial and nonfinancial requests 
because CBP does not provide outside entities access to its tracking 
system. As a result, requesters seeking status information for 
noncommercial or nonfinancial requests, which account for approximately 
95 percent of CBP's requests, must phone their inquiry to personnel at 
CBP's central office. By providing an online status check service, the 
Coast Guard and CBP could improve customer service and reduce staff 
resources devoted to responding to status inquiries. 
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The format (paper or electronic) on which records are released to 
requesters can affect operating expenditures and processing efficiency. 
Based on actions taken at DOJ, as well as within several DHS components, 
using electronic dissemination to respond to "large" requests (requests 
involving many document pages) can decrease the amount of resources 
expended on paper, toner, and postage. In such cases, agency officials 
report that the cost of copying responsive records onto a CD and mailing 
the CD to the requester is generally significantly less than printing and 
mailing the information on paper. 

DOJ has used electronic dissemination to improve the efficiency of its 
processing. For example, the Executive Office for Immigration Review has 
used electronic dissemination to streamline its FOIA process. Prior to 
adopting a policy of providing records on CD by default, the Executive 
Office's staff often engaged in lengthy negotiations with requesters over 
reproduction fees. Agency officials cited the transition to releasing records 
on CD as a major factor in reducing the agency's backlog because it 
reduced the need for staff to spend time negotiating over fees with 
requesters. 

Likewise, three of DHS's seven major components have used electronic 
dissemination to reduce operating costs when responding to large 
requests: 

• USCIS officials reported that they respond to approximately 60 percent of 
requests by mailing electronic copies of records on CD, accounting for 80 
percent of the total number of released pages. The remaining 40 percent of 
requests are released on paper, either because the request is less than 15 
pages or because the requester specifically requests a paper format. 
Although they have not documented the costs of providing responsive 
records on CD, USCIS officials estimated that electronic dissemination 
had reduced their paper and toner costs by half. 

• ICE also has a policy of releasing records on CD, except when a requester 
specifies paper. ICE's FOIA Information System Security Officer estimated 
that electronic dissemination had reduced the office's paper consumption 
by almost 90 percent. 

• FEMA also has a policy of using electronic dissemination (on CD) for large 
requests. 

DHS's four remaining major components release records on paper, unless 
otherwise specified by the requester: 



Releasing Records for 
Large Requests in an 
Electronic Format Could 
Provide Cost Savings and 
Improve Efficiency 
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• CBP officials stated that they were focusing their efforts on hiring staff to 
process requests and they would consider process enhancements, such as 
electronic dissemination, once they achieved full staffing. 

• Coast Guard officials stated that they had not adopted a policy of 
defaulting to an electronic format because they had not received guidance 
from DHS on this subject and because it may be less expensive for them to 
reproduce records on paper. 

• TSA officials stated that their FOIA office releases records on paper based 
on its understanding that this is the preference of requesters, and only 
provides records in electronic format when specifically requested. 

• USSS officials stated that the agency considered adopting a policy of 
releasing records electronically or on CD when FOIA requesters did not 
specify a preference for paper, but decided not to adopt such a policy out 
of deference to requesters who do not have the means or capability to 
access information stored electronically. 

While it may be less expensive to respond to small requests in a paper 
format, it can be more economical to respond to large requests in an 
electronic format. Adopting a release policy that more fully incorporates 
electronic means of dissemination when it is economically advisable could 
reduce the operational costs of processing requests, as well as the staff 
resources diverted to negotiating the release format with requesters. 



Rapidly and accurately removing (redacting) nonreleasable data from 
requested records is an integral part of responding to FOIA requests in a 
timely manner. DOJ's Implementation Guidance notes that electronic 
redaction software can enable agencies to process requests more 
efficiently than through manual redaction. 12 Based on actions taken at DOJ 
and the Department of State, as well as within several DHS components, 
the use of electronic redaction can allow for more timely responses to 
requests. Electronic redaction involves using software to eliminate 
nonreleasable data from electronic files. The software allows staff to 
quickly select text or images to be removed and annotate the text with the 
reasons (applicable exemptions) for the redactions. Manual redaction is 



12 Department of Justice, Executive Order 13392 Implementation Guidance (posted Apr. 27, 
2006). See http://www.usdoj.gov/oip/foiapost/2006foiapost6.htm. 
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more labor-intensive, typically involving photocopying or scanning a 
document after removing nonreleasable information by physically cutting, 
covering, or marking each page. 

Officials at DOJ and the Department of State reported that electronic 
redaction had led to improvements in the efficiency of their operations for 
processing information requests. FBI officials stated that electronic 
redaction had enabled the agency to significantly reduce staff while 
doubling productivity. Since 2002, the use of automation, including 
electronic redaction, has allowed the FBI to reduce staff levels from 630 to 
230 employees, while reducing its number of pending requests from 2,500 
to 1,800. Also, the rate of processing by individual staff was reported to 
have increased from 500 pages to 1,000 pages per month. Likewise, Bureau 
of Prisons officials estimated that electronic redaction had reduced 
redaction time by 10 percent. The State Department's Director of 
Information Programs and Services likewise credited electronic redaction 
with improving efficiency and also noted that it resulted in a more 
professional product. 

Officials from several DHS components also reported having improved the 
efficiency or quality of their request processing by adopting electronic 
redaction: 

• CBP officials stated that since November 25, 2008, all of the permanent 
FOIA staff in the central office have used electronic redaction software to 
process records. They estimated that 90 to 95 percent of records are 
redacted electronically. 

• USCIS officials reported that they use electronic redaction exclusively. A 
senior official estimated that, since adopting electronic redaction in 1998, 
the agency had significantly increased the efficiency of the its redaction 
process by eliminating the need to manually cut or mark records. 

• ICE's FOIA Officer stated that electronic redaction had resulted in 
significant time-savings over previous manual redaction processes. 

• According to USSS officials, approximately 70 to 75 percent of the records 
they process are redacted electronically. USSS officials credit electronic 
redaction with increasing productivity, reducing response time frames, 
and improving customer service. The remaining 25 to 30 percent of USSS 
records are processed manually because of security requirements 
prohibiting the electronic redaction of classified records. 
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• FEMA officials reported that they use electronic redaction to respond to 
approximately 90 percent of their requests. FEMA officials stated that 
implementing electronic redaction has enabled faster processing and a 
more professional and consistent product for requesters. FEMA still 
manually processes 10 percent of its records, either because the records 
are classified or because they have already been partially manually 
redacted. 

In contrast, the Coast Guard and TSA do not use electronic redaction 
when responding to the majority of their requests: 

• Coast Guard officials estimated that 7 percent of their FOIA staff have 
access to electronic redaction software, and approximately 70 percent of 
the records processed by those with access are redacted electronically. 
Nevertheless, Coast Guard officials stated that electronic redaction had 
reduced processing time for large volume records and reduced the 
likelihood of improperly releasing information. Coast Guard officials 
added that funding had been requested for an electronic system located at 
all major FOIA processing centers which would enable online redactions. 

• Although all of TSA's FOIA staff members have access to electronic 
redaction software, only 10 percent of records are redacted electronically. 
Agency officials stated that TSA had been unable to adopt electronic 
redaction more broadly because of difficulties integrating the redaction 
software with TSA's file sharing application. The officials added that TSA 
is considering other software solutions that might allow broader adoption 
of electronic redaction. 

By more broadly adopting electronic redaction, the Coast Guard and TSA 
have opportunities to improve the efficiency of their operations. 



While DHS has made advances in ensuring compliance and oversight 
among its components, such as developing a departmentwide handbook 
and monitoring monthly data processing statistics, opportunities exist for 
further improvements. Practices in place at DOJ and the Department of 
State, and within a number of DHS's own component agencies, have 
demonstrated that a variety of enhancements are possible. However, these 
key practices have not yet been implemented consistently across the 
department. Such practices include monitoring and oversight of FOIA 
processing, component-specific training, providing online status 
information, releasing records in electronic format, and using electronic 
redaction. By consistently implementing these practices across all major 
departmental components, DHS is likely to be able to further reduce its 
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backlog, increase efficiency, improve customer service, and respond to 
FOIA requests in a more timely fashion. 



Recommendations for ^° ™P rove * ne efficiency and cost-effectiveness of the department's 

FOIA program, we are recommending that the Secretary of Homeland 
Executive Action Security take the following five actions: 



• Direct the FOIA Officers at the U.S. Customs and Border Protection, 
Federal Emergency Management Agency, Transportation Security 
Administration, and United States Coast Guard to consider establishing 
monitoring and oversight mechanisms to help reduce the backlog of 
overdue requests. 

• Direct the FOIA Officers at the Federal Emergency Management Agency 
and United States Secret Service to consider developing and implementing 
specialized training programs for their staff. 

• Direct the FOIA Officers at the U.S. Customs and Border Protection, 
Federal Emergency Management Agency, Transportation Security 
Administration, United States Coast Guard, and United States Secret 
Service to consider providing requesters with an online mechanism to 
obtain information about the status of their requests. 

• Direct the FOIA Officers at the U.S. Customs and Border Protection, 
Transportation Security Administration, United States Secret Service, and 
United States Coast Guard to consider establishing a policy of primarily 
disseminating records to requesters in an electronic format when large 
numbers of pages are involved. 

• Direct the FOIA Officers at the Transportation Security Administration 
and United States Coast Guard to consider expanding the use of electronic 
redaction when processing requests. 



A^enCV Comments ^ 6 P rov ^^ e( ^ a draft of this report to DHS, DOJ, and the Department of 

° State for review and comment. In response, we received written comments 

from the Director of DHS's GAO/OIG Liaison Office, which are reprinted in 
appendix II. Officials from DOJ and the Department of State indicated that 
they had no comments on the draft report. 

In his written comments, the Director stated that DHS concurred with our 
assessment and recommendations and stated that the department will use 
the report to ensure improvement to its FOIA program in the future. In 
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addition, DHS provided information on actions certain components are 
taking to address our recommendations. DHS also provided technical 
comments by e-mail, which we incorporated as appropriate. 



We are sending copies of this report to the Secretary of Homeland 
Security, the Attorney General, the Secretary of State, and interested 
congressional committees. The report also is available at no charge on the 
GAO Web site at http://www.gao.gov. 

If you or your staffs have questions about this report, please contact me at 
(202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. GAO staff who made major contributions to this report are 
listed in appendix III. 




Gregory C. Wilshusen 

Director, Information Security Issues 
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Appendix I: Objectives, Scope, and 
Methodology 



In enacting the Consolidated Appropriations Act, 2008, the Committees on 
Appropriations directed us to evaluate the operations of the Department 
of Homeland Security's (DHS) Freedom of Information Act (FOIA) 
program. Our specific objectives were to determine (1) what key steps 
DHS has taken to improve its FOIA program, and (2) what opportunities, if 
any, exist to improve the efficiency and cost-effectiveness of FOIA 
operations across the department. 

To determine the key steps DHS has taken to improve its program, we 
reviewed the goals contained in the DHS improvement plan, the reported 
progress made on these goals from the DHS annual FOIA reports, and 
documentation regarding initiatives aimed at improving departmental 
operations. To corroborate information obtained from the DHS Privacy 
Office about the department's actions and reported reductions in backlog, 
we obtained and analyzed supporting information from major 
departmental components by observing processing operations and 
obtaining documentation of improvement initiatives. We focused our work 
on the seven agency components that reported the largest number of 
pending cases at the end of fiscal year 2007: U.S. Customs and Border 
Protection, the Federal Emergency Management Agency, Immigration and 
Customs Enforcement (ICE), the Transportation Security Administration, 
United States Citizenship and Immigration Services (USCIS), the United 
States Coast Guard, and the United States Secret Service. We obtained and 
analyzed documentation and interviewed officials from each of these 
components to assess DHS's performance. We also conducted site visits at 
ICE and USCIS, which account for the majority of requests processed at 
DHS, to analyze information regarding their processes and the 
implementation of improvement initiatives. Further, we interviewed DHS 
officials regarding the impact of organizational, technological, and 
managerial actions on achieving departmental improvement plan goals. 

To determine what opportunities exist to improve the efficiency and cost- 
effectiveness of FOIA operations across the department, we reviewed 
DHS-specific FOIA policies and procedures, including documentation 
regarding program structure, processes, and resources, to determine what 
practices were in place throughout the department. We also reviewed 
laws, regulations, and guidance aimed at improving FOIA operations 
across the government, including Executive Order 13392, the Department 
of Justice's (DOJ) guidance on implementing Executive Order 13392, and 
the Openness Promotes Effectiveness in our National Government Act of 
2007. We then reviewed similar documentation from DOJ and the 
Department of State — two agencies with types of information similar to 
DHS — and compared their programs to DHS operations to identify key 
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Appendix I: Objectives, Scope, and 
Methodology 



practices that could be implemented more widely in DHS to make 
improvements in efficiency and customer service. Specifically, within DOJ, 
we analyzed key practices of FOIA programs at the Federal Bureau of 
Investigation, the Bureau of Prisons, the Executive Office for Immigration 
Review, and the Executive Office for United States Attorneys — the four 
components that reported the largest number of pending cases at the end 
of fiscal year 2007 — by discussing practices with officials, analyzing 
documentation, and observing processing activities firsthand to determine 
the impact they had on program efficiency. To supplement information on 
key practices obtained from DOJ and the Department of State, we 
analyzed documentation and interviewed officials from each of the seven 
major component agencies within DHS to determine which processes and 
improvement initiatives they had implemented and the extent to which 
these actions had produced tangible benefits. For components that had 
not implemented key practices, we obtained and analyzed information 
about the reasons they had not done so. 

We conducted this performance audit from May 2008 to January 2009 in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 
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of Homeland Security 



VS. Bfpirlmmi of ilumtlind S«urllj 

Wishinpon.DC2(!;28 

lift Homeland 
W Security 



February 25, 2009 



Mr. Gregory C. Wilhausen 

Director. Information Security Issues 

United States Government Accountability Office 

Washington, DC 20548 

Dear Mr. Wilhausen: 

Thank you for the opportunity to review and comment on the Government Accountability 
Office's (GAO's) Draft Report GAO-09-260 entitled Freedom of Information Act; DHS Has 
Taken Steps to Enhance its Program, but Opportunities Exist to Improve Efficiency and Cost- 
Effectiveness. The United States Department of Homeland Security (DHS) remains grateful 
for all that the GAO has done to bring attention to issues within our Freedom of Information 
Act (FOIA) Program and concurs with the findings of this report. The Department benefits 
from this oversight and will use it to ensure improvement to our FOIA program in the future. 
We appreciate the commitment the GAO has towards making the DHS FOIA program 
successful. 

RECOMMENDATIONS 

GAO Recommendation #1: Direct the FOIA Officers at the Customs and Border Protection. 
Federal Emergency Management Agency, Transportation Security Administration, United 
States Coast Guard, and United States Secret Service to consider establishing monitoring and 
oversight mechanisms to help reduce the backlog of overdue requests. 

DHS Response: Concur - The Department concurs with this recommendation and the Chief 
FOIA Officer plans to direct the FOIA Officers at the Transportation Security Administration, 
United States Coast Guard and United States Secret Service to consider establishing 
monitoring and oversight mechanisms to help reduce their respective backlogs of overdue 
requests. 

Components such as FEMA and U.S. Customs and Border Protection are already taking steps 
to enhance this aspect of their program. The FEMA Disclosure Branch is developing a FOIA 
Scorecard thai will be shared with FEMA leadership on a weekly basis in order to instill a 
sense of accountability. Furthermore, FEMA's Assistant Administrator for Management 
approved contract funding for a Backlog Reduction Team. This will be a performance-based 
contract in which FEMA's target is to eliminate the backlog within 7 months of award. 
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At U.S. Customs and Border Protection (CBP), the Executive Director. Commercial 
Targeting, Office of International Trade, directed the CBP FOIA Division Director to report 
the FOIA Division activity on a weekly basis, beginning in September 2008. That weekly 
report provides the Executive Director with the on-going progress of reducing the backlog of 
overdue requests. Corrective actions such as temporary duty assignments and shifting the 
focus of CBP FOIA Division priorities are taken in response to the weekly report because of 
the importance of timely responses to FOIA requests. This weekly reporting, along with 
monthly reporting to DHS, will continue, as will any adjustments that are necessary to reduce 
the backlog. The CBP FOIA Division will monitor the progress made on reducing the 
existing backlog to work toward the goal of eliminating it in the summer of 2009. 

GAO Recommendation #2: Direct the FOIA Officers at the Federal Emergency 
Management Agency and United States Secret Service to consider developing and 
implementing specialized training programs for their staff. 

DHS Response: Concur - The Department concurs with this recommendation and has begun 
addressing the issue. The Disclosure Branch at FEMA, for example, has tailored the U.S. 
Department of Justice training to the specific FOIA exemptions utilized most frequently 
within FEMA. Furthermore, the FEMA Disclosure Branch is in the process of developing a 
component-specific training to be utilized with the incoming contractor support as well as the 
program office points of contact. The Chief FOIA Officer will direct the FOIA Officer at the 
United States Secret Service to consider augmenting existing training programs to provide 
specialized training opportunities for their staff. 

GAO Recommendation #3: Direct the FOIA Officers at the Customs and Border Protection, 
Federal Emergency Management Agency, Transportation Security Administration, United 
States Coast Guard, and United States Secret Service to consider providing requesters with an 
online mechanism to obtain information about the status of their requests. 

DHS Response: Concur - The Department concurs with this recommendation. The DHS 
Privacy Office recommended component FOIA offices follow USCIS' lead in this arena in 
June 2008. Two components, U.S. Citizenship and Immigration Services and U.S. 
Immigration and Customs Enforcement (ICE), for example, have already implemented online 
status-check mechanisms for requesters. Several other components, including Customs and 
Border Protection are currently assessing the feasibility of implementing this type of feature. 
The Chief FOIA Officer plans to direct the FOIA Officers at the Federal Emergency 
Management Agency, Transportation Security Administration, United States Coast Guard and 
United States Secret Service to consider providing requesters with an online status check tool. 

GAO Recommendation #4: Direct the FOIA Officers at the Customs and Border Protection, 
Transportation Security Administration, United States Secret Service and United States Coast 
Guard to consider establishing a policy of primarily disseminating records to requesters in an 
electronic format when large numbers of pages are involved. 

DHS Response: Concur - The Department concurs with this recommendation and the Chief 
FOIA Officer will direct the FOIA Officers at Customs and Border Protection, Transportation 
Security Administration, United States Secret Service and United States Coast Guard to 
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consider establishing a policy of primarily disseminating records to requesters in an electronic 
format when large numbers of pages are involved. 

GAO Recommendation #5: Direct the FOIA Officers at the Transportation Security 
Administration and United Stales Coast Guard to consider expanding the use of electronic 
redaction when processing requests, 

DHS Response: Concur - The Department concurs with this recommendation and plans to 
direct the FOIA Officers at the Transportation Security Administration and United States 
Coast Guard to consider expanding the use of electronic redaction when processing requests. 

We thank you for considering our comments on these very' important issues. We look 
forward to working with the GAO on future Homeland Security issues. 



Sincerely, 



Jerald E. Levine 
Director 

Departmental GAO/OIG 
Audit Liaison Office 
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The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
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